Operating Systems and Web Security: Fall 2012: Difference between revisions
| (11 intermediate revisions by 2 users not shown) | |||
| Line 18: | Line 18: | ||
<tr valign="top"> | <tr valign="top"> | ||
<th> | <th> | ||
<p align="left">Date</p> | <p align="left">Date </p> | ||
</th> | </th> | ||
<th> | <th> | ||
| Line 340: | Line 340: | ||
</td> | </td> | ||
<td> | <td> | ||
<p>[http://homeostasis.scs.carleton.ca/~soma/ | <p>[http://homeostasis.scs.carleton.ca/~soma/oswebsec/iOS_Security_May12.pdf iOS Security], [http://source.android.com/tech/security/ Android Security] | ||
</p> | </p> | ||
</td> | </td> | ||
| Line 358: | Line 358: | ||
</td> | </td> | ||
<td> | <td> | ||
<p>Felt et al., [https://www.eecs.berkeley.edu/~daw/papers/perms-webapps11.pdf The Effectiveness of Application Permissions] | <p>Felt et al., [https://www.eecs.berkeley.edu/~daw/papers/perms-webapps11.pdf The Effectiveness of Application Permissions]<br> | ||
Lie & Litty, [http://sites.google.com/site/lionellitty/research/publications/STC10.pdf Using Hypervisors to Secure Commodity Operating Systems] | Lie & Litty, [http://sites.google.com/site/lionellitty/research/publications/STC10.pdf Using Hypervisors to Secure Commodity Operating Systems] | ||
</p> | </p> | ||
</td> | </td> | ||
<td> | <td> | ||
<p> | <p>[[OSWebSec: App Perms & Hyperviz|App Perms Hyperviz]] | ||
</p> | </p> | ||
</td> | </td> | ||
| Line 377: | Line 377: | ||
</td> | </td> | ||
<td> | <td> | ||
<p>Belay et al., [http://www.scs.stanford.edu/~dm/home/papers/belay:dune.pdf Dune: Safe User-level Access to Privileged CPU Features] | <p>Belay et al., [http://www.scs.stanford.edu/~dm/home/papers/belay:dune.pdf Dune: Safe User-level Access to Privileged CPU Features]<br> | ||
McCune et al., [http://www.cs.purdue.edu/homes/bertino/426Fall2009/flicker.pdf Flicker: An Execution Infrastructure for TCB Minimization] | McCune et al., [http://www.cs.purdue.edu/homes/bertino/426Fall2009/flicker.pdf Flicker: An Execution Infrastructure for TCB Minimization] | ||
</p> | </p> | ||
| Line 396: | Line 396: | ||
</td> | </td> | ||
<td> | <td> | ||
<p>De Groef et al., [https://lirias.kuleuven.be/bitstream/123456789/354589/2/fp015-degroef.pdf FlowFox: a Web Browser with Flexible and Precise Information Flow Control] | <p>De Groef et al., [https://lirias.kuleuven.be/bitstream/123456789/354589/2/fp015-degroef.pdf FlowFox: a Web Browser with Flexible and Precise Information Flow Control]<br> | ||
Wang et al., [http://www.usenix.org/event/sec09/tech/full_papers/wang.pdf The Multi-Principal OS Construction of the Gazelle Web Browser] | Wang et al., [http://www.usenix.org/event/sec09/tech/full_papers/wang.pdf The Multi-Principal OS Construction of the Gazelle Web Browser] | ||
</p> | </p> | ||
| Line 415: | Line 415: | ||
</td> | </td> | ||
<td> | <td> | ||
<p>Mickens & Dhawan, [http://research.microsoft.com/pubs/154698/Atlantis-SOSP.pdf Atlantis: Robust, Extensible Execution Environments for Web Applications] | <p>Mickens & Dhawan, [http://research.microsoft.com/pubs/154698/Atlantis-SOSP.pdf Atlantis: Robust, Extensible Execution Environments for Web Applications]<br> | ||
Chen et al., [http://www.collinjackson.com/research/papers/appisolation.pdf App Isolation: Get the Security of Multiple Browsers with Just One] | Chen et al., [http://www.collinjackson.com/research/papers/appisolation.pdf App Isolation: Get the Security of Multiple Browsers with Just One] | ||
</p> | </p> | ||
</td> | </td> | ||
<td> | <td> | ||
<p> | <p>[[OSWebSec: Browser Implementations|Browser Imp Notes]] | ||
</p> | </p> | ||
</td> | </td> | ||
| Line 434: | Line 434: | ||
</td> | </td> | ||
<td> | <td> | ||
<p> | <p>Chen et al., [http://www.cs.purdue.edu/homes/bertino/426Fall2009/overshadow.pdf Overshadow: A Virtualization-Based Approach to Retrofitting Protection in Commodity Operating Systems]<br> | ||
Andrus et al., [http://web4.cs.columbia.edu/~nieh/pubs/sosp2011_cells.pdf Cells: A Virtual Mobile Smartphone Architecture] | |||
</p> | </p> | ||
</td> | </td> | ||
| Line 452: | Line 453: | ||
</td> | </td> | ||
<td> | <td> | ||
<p> | <p>Akhawe, Saxena, & Song, [https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final168.pdf Privilege Separation in HTML5 Applications]<br> | ||
Tang et al., [http://www.cs.columbia.edu/~roxana/research/projects/cleanos/osdi2012cleanos.pdf CleanOS: Limiting Mobile Data Exposure with Idle Eviction] | |||
</p> | </p> | ||
</td> | </td> | ||
| Line 498: | Line 500: | ||
<tr> | <tr> | ||
<td> | <td> | ||
<p> | <p>Dec. 4, 10 AM | ||
</p> | |||
</td> | |||
<td> | |||
<p>[[OSWebSec: Final Exam Study Guide|Final Exam Study Session]] | |||
</p> | |||
</td> | |||
<td> | |||
<p> | |||
</p> | |||
</td> | |||
<td> | |||
<p> | |||
</p> | |||
</td> | |||
</tr> | |||
<tr> | |||
<td> | |||
<p>Dec. 6, 9 AM<br>SA 404 | |||
</p> | </p> | ||
</td> | </td> | ||
Latest revision as of 16:43, 12 March 2013
Course Outline
The outline of the course can be found here.
Reading Responses
In general, reading responses should be turned in by 8 PM on Monday prior to the associated readings being discussed in class. Submitted reading responses should be no more than 1000 words in total for discussion of all the week's readings. (NOT 1000 words per reading!) Reading responses should be a discussion of what you got out of the readings and what questions you still have. I will attempt to read everyone's responses before class so I have an idea how to direct in-class discussion. In particular, I will be looking for topics on which to give more background.
Suggestion on how to do responses: Read all the papers first, then take a break, then write a response. Don't write after each reading. You don't even need to take notes unless that is how you read papers.
The first reading response is due on Monday, September 17th, 8 PM. Note that this response should also discuss how useful and enjoyable the unsupervised in-class discussion of the readings went.
Responses should be submitted via Carleton's new cuLearn.